On Tuesday, August 30, 2011 07:18:02 PM Miloslav Trmac wrote: Right. AUDIT_PID is an event record type which would be returned by auparse_get_type(). If you look in auparse.h, you can see the groupings of functions that access event level, record level, and field level components. Yes, but the intent of AUPARSE_TYPE_UNCLASSIFIED is to say that the field contains data that needs no special cross reference or conversion to be human readable (or as you say we don't know about the field). This is different from returning something to say that you are not pointed at a valid field - i.e. you ran off the end. From what I can tell, you can only get the error if you are moving the internal pointer around without checking return codes. There really is an unintended API mistake in there. :) Maybe looking at the auparse.h file clarifies a few things since they are grouped? -Steve